Bug 1205386 (CVE-2022-37967) - VUL-0: CVE-2022-37967: samba: Windows Kerberos Elevation of Privilege Vulnerability.
Summary: VUL-0: CVE-2022-37967: samba: Windows Kerberos Elevation of Privilege Vulnera...
Status: RESOLVED FIXED
Alias: CVE-2022-37967
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Major
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/347630/
Whiteboard: CVSSv3.1:SUSE:CVE-2022-37967:7.2:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2022-11-14 09:17 UTC by Marcus Meissner
Modified: 2024-05-03 09:08 UTC (History)
8 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Comment 2 Marcus Meissner 2022-11-14 09:18:36 UTC
The samba upstream team is currently investigating if this problem affects samba.
Comment 4 Jazz 2022-12-19 08:03:11 UTC
(In reply to Marcus Meissner from comment #2)
> The samba upstream team is currently investigating if this problem affects
> samba.

15 December 2022

Samba 4.17.4, 4.16.8 and 4.15.13 Security Releases are available for Download

This are the latest stable releases. They also contain security changes in order to address CVE-2022-38023, CVE-2022-37966, CVE-2022-37967 and CVE-2022-45141.

The uncompressed tarball has been signed using GnuPG (ID AA99442FB680B620).

The Samba 4.17.4 source code can be downloaded now. A patch against Samba 4.17.3 is also available. See the release notes for more info.

The Samba 4.16.8 source code can be downloaded now. A patch against Samba 4.16.7 is also available. See the release notes for more info.

The Samba 4.15.13 source code can be downloaded now. A patch against Samba 4.15.12 is also available. See the release notes for more info.

Link: https://www.samba.org/samba/history/
Comment 6 Swamp Workflow Management 2023-01-02 23:21:25 UTC
SUSE-SU-2023:0014-1: An update that solves three vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1205385,1205386,1205946,1206504
CVE References: CVE-2022-37966,CVE-2022-37967,CVE-2022-38023
JIRA References: 
Sources used:
openSUSE Leap Micro 5.2 (src):    samba-4.15.13+git.540.fab3b2a46c6-150300.3.46.1
SUSE Manager Server 4.2 (src):    samba-4.15.13+git.540.fab3b2a46c6-150300.3.46.1
SUSE Manager Retail Branch Server 4.2 (src):    samba-4.15.13+git.540.fab3b2a46c6-150300.3.46.1
SUSE Manager Proxy 4.2 (src):    samba-4.15.13+git.540.fab3b2a46c6-150300.3.46.1
SUSE Linux Enterprise Server for SAP 15-SP3 (src):    samba-4.15.13+git.540.fab3b2a46c6-150300.3.46.1
SUSE Linux Enterprise Server 15-SP3-LTSS (src):    samba-4.15.13+git.540.fab3b2a46c6-150300.3.46.1
SUSE Linux Enterprise Realtime Extension 15-SP3 (src):    samba-4.15.13+git.540.fab3b2a46c6-150300.3.46.1
SUSE Linux Enterprise Module for Python2 15-SP3 (src):    samba-4.15.13+git.540.fab3b2a46c6-150300.3.46.1
SUSE Linux Enterprise Module for Basesystem 15-SP3 (src):    samba-4.15.13+git.540.fab3b2a46c6-150300.3.46.1
SUSE Linux Enterprise Micro 5.2 (src):    samba-4.15.13+git.540.fab3b2a46c6-150300.3.46.1
SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS (src):    samba-4.15.13+git.540.fab3b2a46c6-150300.3.46.1
SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS (src):    samba-4.15.13+git.540.fab3b2a46c6-150300.3.46.1
SUSE Linux Enterprise High Availability 15-SP3 (src):    samba-4.15.13+git.540.fab3b2a46c6-150300.3.46.1
SUSE Enterprise Storage 7.1 (src):    samba-4.15.13+git.540.fab3b2a46c6-150300.3.46.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 10 Swamp Workflow Management 2023-01-26 20:26:06 UTC
SUSE-SU-2023:0160-1: An update that solves 11 vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 1200102,1201490,1201492,1201493,1201495,1201496,1201689,1204254,1205126,1205385,1205386,1206504,1206546
CVE References: CVE-2021-20251,CVE-2022-2031,CVE-2022-32742,CVE-2022-32744,CVE-2022-32745,CVE-2022-32746,CVE-2022-3437,CVE-2022-37966,CVE-2022-37967,CVE-2022-38023,CVE-2022-42898
JIRA References: 
Sources used:
openSUSE Leap Micro 5.3 (src):    samba-4.15.13+git.591.ab36624310c-150400.3.19.1
openSUSE Leap 15.4 (src):    samba-4.15.13+git.591.ab36624310c-150400.3.19.1
SUSE Linux Enterprise Module for Basesystem 15-SP4 (src):    samba-4.15.13+git.591.ab36624310c-150400.3.19.1
SUSE Linux Enterprise Micro 5.3 (src):    samba-4.15.13+git.591.ab36624310c-150400.3.19.1
SUSE Linux Enterprise High Availability 15-SP4 (src):    samba-4.15.13+git.591.ab36624310c-150400.3.19.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 11 Samuel Cabrero 2023-02-22 09:41:38 UTC
Reassigned to the security team to close it.
Comment 12 Robert Frohl 2024-05-03 09:08:56 UTC
done, closing